Analysis
-
max time kernel
59s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
04-07-2024 23:57
General
-
Target
26b78358c63710aeb562fb47644e230e_JaffaCakes118.exe
-
Size
821KB
-
MD5
26b78358c63710aeb562fb47644e230e
-
SHA1
a8a8734c0500e270c363a7df2bd82e70ff840495
-
SHA256
8bb96b66c673841d4a513bb85a94ee3ded5bd30689173e5be16ed69c30766a00
-
SHA512
30a4f2034492141cc341ebde56ae1d28cfdd5152275db7f7078e4338b09e0ba4cdeb5eb343cb2d73c0ef9600e50e3252ed9fdb0314ba2d5270d21479b9e5f5bb
-
SSDEEP
12288:9xzvtHKFjnkAqqCy/0GgjV4U3T+q7HpqWyTw424jDjNyCRSE7Y1niMjaR056mcfg:9xzlqFbLq5ogjzTxLmf24j9ymBkia2Y
Score
10/10
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 7 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 10 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\26b78358c63710aeb562fb47644e230e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\26b78358c63710aeb562fb47644e230e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\Susan Beth Pfeffer - Last Survivors 02 - The Dead And The Gone.exe"C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\Susan Beth Pfeffer - Last Survivors 02 - The Dead And The Gone.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\ic5.exe"C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\ic5.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\2 Gansta.exe"C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\2 Gansta.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\2GANST~1.EXE > nul3⤵
-
C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\3R2R.exe"C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\3R2R.exe"2⤵
- Modifies security service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\3R2R.exeC:\Users\Admin\AppData\Local\Temp\nszC381.tmp\3R2R.exe startC:\Users\Admin\AppData\Roaming\8358A\43690.exe%C:\Users\Admin\AppData\Roaming\8358A3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\3R2R.exeC:\Users\Admin\AppData\Local\Temp\nszC381.tmp\3R2R.exe startC:\Program Files (x86)\8AA11\lvvm.exe%C:\Program Files (x86)\8AA113⤵
- Executes dropped EXE
-
C:\Program Files (x86)\LP\9018\3F37.tmp"C:\Program Files (x86)\LP\9018\3F37.tmp"3⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Active Setup
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\LP\9018\3F37.tmpFilesize
96KB
MD5ba4818120b8c3c87a4437450f5968ea5
SHA1d6e47a0c2b2bd8abef58f8d17d1883fc712e4301
SHA25659d73ca73fa8bbec1bbcd19299ed082eb7a1f8f2c5343a498420a08f25bb8be9
SHA5120c5e85d700f097a4dd299fc18019037bce4abcace311420bcc8011fc94ff247680112ce59fd0a1b9095aa988262c0ef5b1c903686fb864bd85e162a473599558
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbresFilesize
2KB
MD5afaf15d2a40a450080dc28d877c7905d
SHA15a50f3ddb4d3a45afa45942343f732d9432b43bb
SHA256b621faacb60fad86d4edfc99b1558343fce9540a475e43790ff06473d7375c61
SHA512832c7f8eeaa3fb6d89cef543ff2387b995d143e7dbee6d3726bb25297044e48178ae6ad637ba073f4c815251173c2c9cae773bab71a9274922d4939e789e3efa
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133646416749214701.txtFilesize
75KB
MD5ddcb015e07a972b51675e3e09102f6fb
SHA1eaf3972c5f7fdd60ba8079daf4b2e66c4840fd2b
SHA256cb7254a884079478eb45b3b70e98495127cf68bf4a61a519b96bc89e48206413
SHA512450b7b0daaa4ca80f1c6414db18c35292423bee15d26fc0b2ea514244264c0bef98c621d54c91338306747334f3736f1bd8eaff9c186187173c8e6d85c1f140d
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\NYEUYJCU\microsoft.windows[1].xmlFilesize
97B
MD5f880a601483e658cfaa2e7f7a45f7e02
SHA195b83079bcb6351a32b1ebf2b48754d50cfa77c9
SHA2562fa9f581ff26983eec4ad8dc44539ae88480a1530e58fa982925093b8ba41d54
SHA51205aaf9711dc011e8c5ae0ff67169b3fdbc98d8ddb2da685075ad0043232c4e9235efd8894a93f438da0404102f367ce91f9d284e2d1203a8f45242a9f262d3c6
-
C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\2 Gansta.exeFilesize
6KB
MD5bee76c79e2e63e198038e01f0d571038
SHA1fcffdd6bb030f516a46e9d303ebae2ab33af222e
SHA25650a3c7134460bfe5f2840bd8dc957edfaa76da5beaaff70f8da5e0fef80ae876
SHA512dd2e9488ad365c02722e1a2466acffb8beaf4dbb68d7093e01c50cd915418ca0642cb6bdd43f2f2b014455803f3c69dec24ca9dfee11bdf7790379181cd2f6f9
-
C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\3R2R.exeFilesize
268KB
MD58950bca822967c72154e56665ba6f7f2
SHA127b8fa27459b32d3e7036a12dfa491ed08830ae7
SHA2567bd9c2658c5bbc607001260297b4af162867658ffd5193852f06cf0129f7b2fb
SHA5123d0dbe3eaa770fc9f94d88d6c7086cb5c7c12265f8d24751d320c53ad60bf3ebaf339d4bd70bd35c8db6edfaf803a6dda575348029e3e30f8cc3d96944d2b400
-
C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\Susan Beth Pfeffer - Last Survivors 02 - The Dead And The Gone.exeFilesize
286KB
MD5103ba9354c4e9d347ff6f8ce79d5ac78
SHA1f712236f2aaf09b55a5cb0fabc4ff30211b81ba9
SHA25696dc78faba687cc3d2487bea020eb023e8213bf93ad605d180126cfc71a65d2e
SHA512a2d11c8d0a23f5d2e7525c6730258cb7d2fff6e2a95fb04b4937919176f95a2f437a22868d6c27fb573ca9b16a0779369eb74f8b90d752012b8608dac9b90b28
-
C:\Users\Admin\AppData\Local\Temp\nszC381.tmp\ic5.exeFilesize
221KB
MD53fda867750c14c38b0a1f79f79298825
SHA1463fc723237fb873fd6b8dd169d5afb47e33bab2
SHA256277c29efe466336c6de187db9f1f25ee35a7be9fdd1edf438cceb96b3bc8d9b8
SHA51286c59af52b1874c804a2579a5c2f61dac156f7aa5c5337108d262ae974868a29305c86dab2d1ab425169e2ea97b90638f028831d58f8093955632204206a01b4
-
C:\Users\Admin\AppData\Roaming\8358A\AA11.358Filesize
1KB
MD5b5f6f0990b9f4e36c5fc80bedb5e3a0a
SHA1c1d21998da1d784d40f8da185fcea6a6462dbd6f
SHA2568653daf2cde3cdbd51c8cef3f21601ff151211c1c67a230fbde35a91b7b5dffd
SHA51234147a2e53313d3ba413672f728d68a00c290fcf0c762c0ee8aeb898d076c47196aa4844d527e935368f3a4e3579bd56e6cab79f53f6a35010f3daf204822ab1
-
C:\Users\Admin\AppData\Roaming\8358A\AA11.358Filesize
996B
MD5ede0acbdcb7745cf2156cfe95cdfd87f
SHA198925e6fb575575dec8793584bad9386b03ba1a9
SHA256a061899c10d62a7c9836b5de4027e6acd95d55c32abb8a1274e8dec40cdea6ad
SHA5122fd315eef990a699f92cddf269b84138de92f184352e47b113da0042bbb8a6679b0a45c289f5c55e97656166c4566fc3461466b59a0e0719ad9bd85bc2ab6ff1
-
C:\Users\Admin\AppData\Roaming\8358A\AA11.358Filesize
1KB
MD5122f3d8869b463cc2fa32642264c83f7
SHA1f48946b8df0a6b6af49327e32abfc23a4c5b1901
SHA256ff2195d869a9b1f45a8020680f09bb141133501eeb66206db6b4eda4190c0535
SHA5122e2f8254633263f9d39938ff46ef1e2e2e6e5799bfbe5bf1f0d9429624f8c31bcd95a7c75dfa1593e2e99d44f3808e9c06da948ab41b934eba98d9828e29331d
-
C:\Users\Admin\AppData\Roaming\8358A\AA11.358Filesize
600B
MD5696ff1ba3633e13c8c25f2cc0639c854
SHA19d8de486ff8fb40c0e429a2d2e738be7affe2cc2
SHA256df813f83092251cbc276c51519dfa21a9293f1d7017cfe3792dafa943319b5d5
SHA5122465d8cf1b6f239d9979bdb1660e73ab3e4a3494935a22fc3e50475b988f42ff6bfd6dd969c3324ff9f20b0a4b9316848f049f0ff311249d6dea2d51812cad23
-
memory/428-1143-0x000001BBB1000000-0x000001BBB1100000-memory.dmpFilesize
1024KB
-
memory/428-1155-0x000001BBB1EC0000-0x000001BBB1EE0000-memory.dmpFilesize
128KB
-
memory/428-1144-0x000001BBB1000000-0x000001BBB1100000-memory.dmpFilesize
1024KB
-
memory/428-1148-0x000001BBB1F00000-0x000001BBB1F20000-memory.dmpFilesize
128KB
-
memory/428-1171-0x000001BBB24E0000-0x000001BBB2500000-memory.dmpFilesize
128KB
-
memory/664-183-0x00000000045E0000-0x00000000045E1000-memory.dmpFilesize
4KB
-
memory/712-1290-0x0000025B63000000-0x0000025B63100000-memory.dmpFilesize
1024KB
-
memory/712-1289-0x0000025B63000000-0x0000025B63100000-memory.dmpFilesize
1024KB
-
memory/712-1288-0x0000025B63000000-0x0000025B63100000-memory.dmpFilesize
1024KB
-
memory/712-1293-0x0000025B64160000-0x0000025B64180000-memory.dmpFilesize
128KB
-
memory/712-1316-0x0000025B64520000-0x0000025B64540000-memory.dmpFilesize
128KB
-
memory/712-1303-0x0000025B64120000-0x0000025B64140000-memory.dmpFilesize
128KB
-
memory/720-667-0x000002725D960000-0x000002725D980000-memory.dmpFilesize
128KB
-
memory/720-674-0x000002725D920000-0x000002725D940000-memory.dmpFilesize
128KB
-
memory/720-698-0x000002725DD30000-0x000002725DD50000-memory.dmpFilesize
128KB
-
memory/736-966-0x000001A924670000-0x000001A924690000-memory.dmpFilesize
128KB
-
memory/736-996-0x000001A924A40000-0x000001A924A60000-memory.dmpFilesize
128KB
-
memory/736-971-0x000001A924630000-0x000001A924650000-memory.dmpFilesize
128KB
-
memory/736-962-0x000001A923520000-0x000001A923620000-memory.dmpFilesize
1024KB
-
memory/736-961-0x000001A923520000-0x000001A923620000-memory.dmpFilesize
1024KB
-
memory/836-1442-0x0000000004410000-0x0000000004411000-memory.dmpFilesize
4KB
-
memory/904-509-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/964-1141-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/1176-960-0x0000000004010000-0x0000000004011000-memory.dmpFilesize
4KB
-
memory/1712-357-0x00000000045E0000-0x00000000045E1000-memory.dmpFilesize
4KB
-
memory/1868-820-0x00000146ABB90000-0x00000146ABBB0000-memory.dmpFilesize
128KB
-
memory/1868-852-0x00000146ABF60000-0x00000146ABF80000-memory.dmpFilesize
128KB
-
memory/1868-848-0x00000146ABB50000-0x00000146ABB70000-memory.dmpFilesize
128KB
-
memory/2104-120-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2664-813-0x00000000040A0000-0x00000000040A1000-memory.dmpFilesize
4KB
-
memory/2912-53-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3020-516-0x0000027E832E0000-0x0000027E83300000-memory.dmpFilesize
128KB
-
memory/3020-528-0x0000027E832A0000-0x0000027E832C0000-memory.dmpFilesize
128KB
-
memory/3020-538-0x0000027E838C0000-0x0000027E838E0000-memory.dmpFilesize
128KB
-
memory/3020-511-0x0000027E82500000-0x0000027E82600000-memory.dmpFilesize
1024KB
-
memory/3020-512-0x0000027E82500000-0x0000027E82600000-memory.dmpFilesize
1024KB
-
memory/3324-354-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3324-54-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3324-122-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3324-1435-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3720-42-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/3720-25-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/4144-359-0x00000223B5250000-0x00000223B5350000-memory.dmpFilesize
1024KB
-
memory/4144-361-0x00000223B5250000-0x00000223B5350000-memory.dmpFilesize
1024KB
-
memory/4144-364-0x00000223B63B0000-0x00000223B63D0000-memory.dmpFilesize
128KB
-
memory/4144-376-0x00000223B6370000-0x00000223B6390000-memory.dmpFilesize
128KB
-
memory/4144-396-0x00000223B6780000-0x00000223B67A0000-memory.dmpFilesize
128KB
-
memory/4344-353-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/4364-1446-0x0000015469500000-0x0000015469600000-memory.dmpFilesize
1024KB
-
memory/4364-1445-0x0000015469500000-0x0000015469600000-memory.dmpFilesize
1024KB
-
memory/4384-659-0x0000000004560000-0x0000000004561000-memory.dmpFilesize
4KB
-
memory/4524-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4984-200-0x000001AC4E300000-0x000001AC4E320000-memory.dmpFilesize
128KB
-
memory/4984-187-0x000001AC4D400000-0x000001AC4D500000-memory.dmpFilesize
1024KB
-
memory/4984-186-0x000001AC4D400000-0x000001AC4D500000-memory.dmpFilesize
1024KB
-
memory/4984-185-0x000001AC4D400000-0x000001AC4D500000-memory.dmpFilesize
1024KB
-
memory/4984-190-0x000001AC4E340000-0x000001AC4E360000-memory.dmpFilesize
128KB
-
memory/4984-215-0x000001AC4E920000-0x000001AC4E940000-memory.dmpFilesize
128KB
-
memory/5076-1287-0x00000000043E0000-0x00000000043E1000-memory.dmpFilesize
4KB